FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations

A joint advisory from CISA, the FBI, the US Secret Service, and allied international agencies details the ongoing threat posed by the ransomware group SafePay. Since August 2024, SafePay has targeted at least 600 organizations across various critical infrastructure sectors spanning North America, South America, Europe, and Australia. The group operates autonomously, distinguishing itself from franchise-style malware operations. Primary attack vectors identified include exploiting exposed credentials, leveraging brute force password attacks, and compromising Virtual Private Network (VPN) access, often utilizing Mullvad VPN IP addresses to reach edge devices via known Common Vulnerabilities and Exposures (CVEs).
Once initial access is gained, attackers utilize standard system administration tools such as PsExec, WinRM, RDP, and PowerShell for lateral movement. The operational model involves a double extortion scheme: data is stolen prior to encryption, then encrypted using ChaCha20/RSA, resulting in files appended with the .SafePay extension. Ransom demands are presented via a TOR-based chat portal. Beyond encryption and theft, the group exhibits aggressive preparation by deleting Volume Shadow Copies and resetting network backups, severely limiting victim recovery options. Recommendations focus heavily on hardening perimeter defenses, implementing Multi-Factor Authentication (MFA), and ensuring immutable offline backups.

CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies published a joint advisory concerning SafePay.
SafePay has impacted at least 600 organizations since August 2024 across critical infrastructure sectors in North America, South America, Europe, and Australia.
The group operates as an independent ransomware entity without affiliates.
Initial access is achieved through exposed credentials, brute force password attacks (T1110), or VPN access.
Attackers utilize Mullvad VPN IP addresses to gain initial access and exploit specific CVEs on edge devices.
Internal network movement relies on tools including PsExec, WinRM, RDP, and PowerShell.
Data exfiltration uses FileZilla, RClone, and OneDrive alongside credential harvesting via Mimikatz.
Encryption utilizes a ChaCha20 stream cipher combined with RSA key exchange; affected files receive the .SafePay extension.
The group employs a double-extortion tactic: theft followed by encryption and ransom demands through a TOR portal.
Advisory recommends enabling MFA for VPNs, webmail, and critical system accounts.
Organizations are advised to keep backups offline, encrypted, and immutable.

This intelligence report maps the modern operational calculus of sophisticated cyber extortion groups, shifting the focus from simple intrusion to comprehensive systemic destruction. The narrative strength lies in its granularity; it moves beyond 'who' is attacking to detailing *how* they move laterally (PsExec, PowerShell) and *what* defensive countermeasures are required (MFA on VPNs). This shifts the conversation from reactive remediation to proactive architectural hardening.
The unstated paradigm driving this threat intelligence is the professionalization of cybercrime into a highly structured, low-overhead service model—a 'ransomware as a service' pipeline evolved for maximum operational security and double leverage. The assumption underpinning the recommendations is that perfect defense is unattainable; thus, resilience must be designed in through redundancy (offline backups) and friction points (MFA).
The implications are stark: digital infrastructure integrity becomes an immediate financial risk necessitating executive-level budgetary focus on defensive engineering rather than just compliance checks. Those who bear the greatest cost are mid-sized entities unable to afford continuous penetration testing or elite 24/7 SOC coverage against such multifaceted attack chains. The concept of 'cutting off every exit before the fire starts' speaks less to technical difficulty and more to a deliberate, high-certainty disruption designed to force rapid capitulation under duress.
What alternative paradigms exist for data recovery that do not rely solely on immutable air-gapped backups? How does one measure the actual organizational risk posed by credential exposure when low-fidelity intelligence is prioritized over exhaustive internal audits? If these sophisticated actors are targeting critical infrastructure across multiple continents, what global regulatory frameworks incentivize proactive defense investment rather than post-incident penalty assessment?
Patterns detected: none